Slashdot Mirror
Ask Slashdot: Changing Passwords For the New Year?
New submitter windcask asks "Every New Year's Day, I assemble and memorize a random collection of seven to ten mixed-case alphanumeric characters and proceed to change every password I have on the interwebs to these characters (plus a few extra characters unique to the site). The problem is I only change them on the sites I visit. Once in a while, I'll come across a site I haven't visited for a few years, and I may end up not being able to guess the password before the try-lockout takes effect. What are your password-changing rituals, and how do they deal with situations like mine? I do use Keepass for work, but it is sometimes impractical for times I'm at other computers."
but it's the new year time to change password12 to password1
I only use correct_horse_battery_staple now that I know how hard it is to guess!
I use a variant of that: Pick a line from a song you know well. It also works well with monthly rotations: Just pick the nth line from the song. Admittedly, last time I had a problem with that when I needed somebody else to use my account and they couldn't spell Ipanema...
To whoever stole my account, please give it back.
My password files just look like this:
/dev/random.
user: damnstupidelf
pass: glintprickjuliatrunkwouldexcelhymnallearhopbloat
first girlfriend: razeblazetrudytdmoltnobitalysankassetzd
high school: actsdrurybyrneavailprofit'llsjmeaddrawpave
some_other_weakest_link_in_site_security_question: alleysandalohmichead60fendweighhamlinwillstout
I sign up for site accounts using email addresses at random domains that will expire soon. No chance of plaintext password-reset emails being sent out and intercepted unless the site uses a non-SSL third party relay.
The password files are symmetrically encrypted with a passphrase that isn't used anywhere else. Long diceware passphrases are immune to rainbow tables, dictionary and brute force attacks, and rubber hose cryptanalysis (I can't remember them), although some worthless sites limit the length of password form fields (shouldn't the site salt and hash passphrases to a fixed number of bits immediately, thus negating the need to limit the length? Yes.) and I have to revert to uuencoding 16 bytes from
The password files are on an encrypted partition using an ephemeral key on a netbook and there's a generator for power outages longer than a couple hours. Alt-SysRq-B has been modified to wipe RAM before rebooting. I hooked up a USB heart monitor as an actual deadman switch to use when I sleep.
NO ONE is getting my WoW forum credentials.
I just login everywhere with FaceBook!! Problem solved!
I object to power without constructive purpose. --Spock
Of course they know this, he just advertised it on a the goddamned Slashdot frontpage!
Random Thoughts From A Diseased Mind (Not For Dummies)
My bank has the same requirement. However, it is only enforced in Javascript. Disable the JS check, and you can use any password you want.